open-design-critique
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled data that can influence agent behavior and task outcomes.
- Ingestion points: Untrusted data enters the agent context through the 'recorded brief' and 'findings' retrieved from the
get_open_design_artifacttool (SKILL.md, Step 2). - Boundary markers: The instructions do not specify the use of boundary markers, XML tags, or delimiters when passing the untrusted brief to the critique agent or subagent (SKILL.md, Step 3).
- Capability inventory: Across the SKILL.md instructions, the agent is granted access to read local design files via
get_open_design_artifact, write metadata viaregister_open_design_artifact, and perform file modifications using 'file-editing tools' during the 'polish' phase (SKILL.md, Step 4). - Sanitization: There is no evidence of filtering, escaping, or validating the brief or previous findings content to prevent embedded instructions from influencing the critique subagent's logic.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to perform file modifications ('apply every finding once with your own file-editing tools') based on findings that may be derived from untrusted inputs. While part of the primary functionality, this creates a vector where a malicious input could result in unintended or unsafe changes to the local file system.
Audit Metadata